Small Business Cybersecurity Checklist for Houston Companies

Effective cybersecurity doesn’t require a Fortune 500 budget — it requires implementing the right controls in the right priority order. This checklist covers the foundational security measures that every Houston small business should have in place. Use it to assess your current security posture and identify gaps that need attention.

Identity and Access Security

• ☐ Multi-factor authentication (MFA) is enabled for all email accounts
• ☐ MFA is enabled for all remote access (VPN, remote desktop)
• ☐ MFA is enabled for all cloud services (Microsoft 365, Google Workspace, banking, etc.)
• ☐ All user accounts use strong, unique passwords (password manager deployed)
• ☐ Departed employees are immediately offboarded and accounts disabled
• ☐ Admin accounts are separate from daily-use accounts
• ☐ Principle of least privilege: users only have access to what they need

Email Security

• ☐ SPF, DKIM, and DMARC records are configured for your domain
• ☐ Advanced spam and phishing filtering is enabled (beyond basic Microsoft/Google defaults)
• ☐ Employees have received phishing awareness training in the last 12 months
• ☐ A simulated phishing test has been run to identify vulnerable users
• ☐ Procedures exist for verifying payment change requests by phone (wire fraud prevention)

Endpoint and Device Security

• ☐ All computers have endpoint protection (EDR, not just basic antivirus)
• ☐ All computers are enrolled in automated patch management
• ☐ Full disk encryption is enabled on all laptops (BitLocker or FileVault)
• ☐ A mobile device management (MDM) solution manages company mobile devices
• ☐ End-of-life operating systems (Windows 7, Windows Server 2012) have been retired

Network Security

• ☐ A business-grade firewall is in place and properly configured
• ☐ Remote Desktop (RDP) is not exposed directly to the internet
• ☐ Guest Wi-Fi is separate from the business network
• ☐ Default passwords have been changed on all network devices
• ☐ Network firmware is kept current

Backup and Recovery

• ☐ All critical data is backed up at least daily
• ☐ Backups are stored off-site or in the cloud (not just on the same local network)
• ☐ Backups have been successfully tested for restoration in the last 6 months
• ☐ Microsoft 365 data is covered by a dedicated backup solution
• ☐ A written disaster recovery plan exists and has been reviewed in the last 12 months

How Many Items Did You Check?

If you couldn’t check every item on this list, you have security gaps that attackers may exploit. Don’t be discouraged — most Houston small businesses have gaps. The important thing is identifying them and addressing them systematically.

xS LLC can implement every control on this checklist as part of our cybersecurity services and managed IT services. Contact us for a free security assessment based on this checklist — we’ll tell you exactly where you stand and what needs to be fixed.